Senior Security Engineer

This is a fully remote position, open to applicants in Poland.

📋 Description

• Take ownership of and enhance application security throughout the Software Development Life Cycle (SDLC), which includes secure design evaluations, threat modeling, security-centric code reviews, and CI/CD-integrated SAST, SCA, and secrets scanning.

• Strengthen our AWS and Kubernetes/EKS environments by focusing on IAM, network segmentation, workload identity, secrets management, admission control, and runtime security measures.

• Secure and enhance our Istio service mesh, emphasizing mTLS, authorization policies, ingress/egress controls, and service-to-service security patterns.

• Develop security guardrails as code, incorporating policy-as-code, paved-road patterns, reusable templates, and self-service tools that enable developers to operate swiftly and securely.

• Enhance software supply chain security through measures like image signing, SBOMs, dependency visibility, artifact provenance, and secure build/release methodologies.

• Lead vulnerability management from start to finish: from triage and exploitability-based prioritization to remediation coordination with SRE and product engineering, ensuring follow-through on penetration test results.

• Create and manage technical controls that comply with HIPAA and SOC 2 standards, including access control, encryption, audit logging, evidence automation, and secure handling of sensitive health information.

• Contribute to defining the complete lifecycle of security services, encompassing design, deployment, operation, measurement, and ongoing improvement.

⛳️ Requirements

• A minimum of 5 years of experience in security engineering, cloud security, application security, or software engineering with a strong emphasis on security.

• Extensive hands-on experience in application security, including threat modeling, secure code reviews, API security, and familiarity with OWASP API Top 10 risks.

• Proven production experience in securing AWS and Kubernetes/EKS environments.

• Practical experience with Istio security in production or production-like settings.

• Strong programming skills in Go or Python.

• Comfortable building tools, automation, and integrations as necessary.

• Familiarity with CI/CD security and infrastructure as code, including tools like Terraform, ArgoCD, or GitOps workflows.

• Experience with Kubernetes policy and networking tools such as Kyverno, OPA, and Cilium.

• Capability to convert security, privacy, and compliance requirements into actionable technical controls.

• At least one experience in regulated environments such as HIPAA, SOC 2, or ISO 27001.

• Ownership mentality: capable of guiding a project from concept through to rollout and operational maturity.

• Proficient in written and spoken English.

• Experience with any of the following is a plus: Supply-chain security tools such as Cosign, sigstore, SBOMs, or image signing; offensive security experience, penetration testing, or bug bounty initiatives.

🏝️ Benefits

• Competitive salary package reflective of your experience, along with stock options.

• All necessary equipment to perform your job effectively.

• 21 days of annual leave in addition to public holidays.

• Office located in Limassol (Hybrid Work Format) or a Remote Option for candidates living outside of Cyprus.